Child Item

Safe recovery of files locked by ransomware

Unfortunately my pc got infected by a ransomware. It locked all my files including the data i had on my dropbox, shared with my colleagues, changing their extension to "lalo".

First, I wanted to know if there is a way to recover my data because they're really important and we've got no backup.
Then i want to make sure these files are not affected by the malware and it can't infect my colleagues' devices.

I would really appreciate it if you could help me.

Find more posts tagged with

Restore

LOL

Accepted answers

Daphne

Hey @Ntorabi, just jumping in here to see if I can help out!

With ransomware attacks, the files on your device are usually just encrypted rather than altered in that way.

However, if you do want to check the files then this isn't something that can be done by Dropbox. You would need to use an antivirus software to do so.

Regarding restoring your files, do you know around how long ago the ransomware affected your device? Was this perhaps outside of your account's version history window?

If you check your Events page here, can you see a large event when your files were affected?

Let me know - thanks!

All comments

Rich

Refer to the following help article:

https://help.dropbox.com/accounts-billing/security/ransomware-recovery

Ntorabi

Thanks for your response,
I used the version history of files while singed from browser, but unfortunatly it didn't work...
All the versions i restore to, are linked with the extension ".lalo"

Ntorabi

- I should add, that i formated my computer and now it's clean,
- And when i go to the version history of files, there's a note there that i have changed the name of file with ".lalo" ...
- How can i make sure that these folders are not containing any virous file? Does dropbox scan files?
- can deleting the whole folder be a safe way to assure it's clean?
- (by the way, i loged on browser right now, i haven't installed the dektop app yet...)

Daphne

Hey @Ntorabi, just jumping in here to see if I can help out!

With ransomware attacks, the files on your device are usually just encrypted rather than altered in that way.

However, if you do want to check the files then this isn't something that can be done by Dropbox. You would need to use an antivirus software to do so.

Regarding restoring your files, do you know around how long ago the ransomware affected your device? Was this perhaps outside of your account's version history window?

If you check your Events page here, can you see a large event when your files were affected?

Let me know - thanks!

Ntorabi

Thanks for your response @Daphne , finaly i recovered my files using the shadow copy of my deleted files,
About the version history, yes i tried to restore to versions before the encryption, but it didn't work, any previous versions i refered to were surprisingly encrypted...
By the way, you were right, the folder was virous free, it was just encrypted

)

Daphne

I'm glad to hear that you had another backup of your files @Ntorabi!

If I can help with anything else, please don't hesitate to get back to me here, I'd be happy to assist.

Hope you have a great week ahead!

isaias

I discovered another way to restore the files without using the Rewind function. It's more laborious, but still functional.
It happens that the ransomware changes the name of the file, so, for example, a file with a name "report.xlsx", becomes "report.xlsx.id[232323-12312].acuff",
What i did was to change the file name to "report.xlsx" again and, that way, Dropbox showed early versions of the file.
After that, I simply restore the files I wanted.

walpole00

My data was encrypted by ransomware pirates. How can I restore files...when i attempt to restore indiviadul files via version history, it fails to restore to the previous file version. Nothing happens.

Any help would be appreciated.

Thanks

Lusil

Hi @walpole00, thanks for reaching out to us.

I moved your post here, where other users have also had a similar issue.

Since you've already tried restoring your files to a previous version though - great work by the way! - could you let me know the exact error message you get?

If you could send me a screenshot, that would be super helpful.

walpole00

I can see each file being 'added'/renamed, then the original file being deleted in the events page. Every file in my drop box in now encrypted. It all happened this morning, file by file at 10:09am. When I try to restore the file, nothing happens (from version history)

walpole00

Heres a screen shot of the events...every file shows as being 'added' with a new file extn, then the original file is deleted. None of the original files that have been deleted are in the deleted folder.

Lusil

In that case, we'll have to take a better look into this together via ticket.

I've sent you one to the email address connected to your Community profile, so when you have the chance, check your inbox and we'll go from there.

Cheers!

Ntorabi

sorry to hear you've got the same problem,

actually the ''version history'' didn't work for me either, any version I refered to from an encrypted file, changed in to an encrypted file despite it wasn't encrypted in that time . I used the "show deleted files'' option in right side of the browser, and restored my files from there one by one,

hope it will work for you too, let me now incase you found another solution for this.

@walpole00

waheed254

It Worked Really.
Thanks Brother.

waheed254

Your Method worked well also get recovered my data.
Thanks

Brenae

Help! I need to urgently rewind my files back to a date prior to 11/2/22. My files have been encrypted by Royal Ransom Virus and I do not have access to my data. Can someone help me with this? I currently have the Basic plan. If I upgrade to the Plus plan will I then be able to Rewind to a previous date?

Do I delete the corrupted files off of my computer, or will the rewind update them automatically, etc.

Can someone please help me ASAP this is very urgent.

Brenda

Mark

Have a look at https://help.dropbox.com/security/ransomware-recovery

Basically you need to clean your machine first and THEN recover. Upgrading to paid will let you rewind 🙂

Brenae

Thank you. My C drive drive did not have any bad files on it. The only folder infected was my Dropbox folder. I uninstalled Dropbox, logged out of my account, et cetera on my local computer.
Should I delete the Dropbox folder on my local computer c drive, before I rewind my files or will the rewind update the files on my local computer you do when I synch?

Mark

Personally I'd just wipe the Dropbox directory and everything near it and then start a fresh 🙂

HALNISS

I found all my files in Dropbox were converted to MITU encrypted files, which can not be opened. It seems I used unsecure internet conection and the laptop was infected with a virus/malware. Is there a solution to recover the files? or to to remove the MITU encryption?

Thank you in advance

Hannah

Hey @HALNISS, I'm so sorry to hear about your files getting encrypted.

Have you taken a look at this article with more info on what to do?